Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    23/08/2024, 21:43

General

  • Target

    2f2831189080a96110997141986aa9f145e519066ac2e1fd26bff6f33e6b5f78.exe

  • Size

    351KB

  • MD5

    71b434aa7371b799de02965ec75cbda3

  • SHA1

    66a4017c57882d39b555c6f2cd96591034d96719

  • SHA256

    2f2831189080a96110997141986aa9f145e519066ac2e1fd26bff6f33e6b5f78

  • SHA512

    45c94bd1b22651234917718d449b9524956a5cbf84784e2c9f865cbb8130cc9caa9e5f0a8706ac4d3c7ad4affc194ea18a8d9bbb17ab43b163344001125756ae

  • SSDEEP

    6144:yaN/f6Hmtc/e3JFXtEmGUj0/9B0rYYS/8XGcgWljoLozcnR2G:yaNX6G6/kJzGBsY8pgsRmn

Malware Config

Extracted

Family

gcleaner

C2

80.66.75.114

Signatures

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

  • Deletes itself 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Kills process with taskkill 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2f2831189080a96110997141986aa9f145e519066ac2e1fd26bff6f33e6b5f78.exe
    "C:\Users\Admin\AppData\Local\Temp\2f2831189080a96110997141986aa9f145e519066ac2e1fd26bff6f33e6b5f78.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2412
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im "2f2831189080a96110997141986aa9f145e519066ac2e1fd26bff6f33e6b5f78.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\2f2831189080a96110997141986aa9f145e519066ac2e1fd26bff6f33e6b5f78.exe" & exit
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1596
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /im "2f2831189080a96110997141986aa9f145e519066ac2e1fd26bff6f33e6b5f78.exe" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2896

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2UK8J8K8\download[1].htm

          Filesize

          1B

          MD5

          cfcd208495d565ef66e7dff9f98764da

          SHA1

          b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

          SHA256

          5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

          SHA512

          31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

        • memory/2412-1-0x0000000000670000-0x0000000000770000-memory.dmp

          Filesize

          1024KB

        • memory/2412-3-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB

        • memory/2412-2-0x00000000002B0000-0x00000000002DD000-memory.dmp

          Filesize

          180KB

        • memory/2412-8-0x0000000000670000-0x0000000000770000-memory.dmp

          Filesize

          1024KB

        • memory/2412-11-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB

        • memory/2412-10-0x0000000000400000-0x00000000005EB000-memory.dmp

          Filesize

          1.9MB

        • memory/2412-22-0x0000000000670000-0x0000000000770000-memory.dmp

          Filesize

          1024KB

        • memory/2412-21-0x0000000000400000-0x000000000042F000-memory.dmp

          Filesize

          188KB

        • memory/2412-20-0x0000000000400000-0x00000000005EB000-memory.dmp

          Filesize

          1.9MB